Documentation
¶
Overview ¶
Package tlsconfig builds the client tls.Config values TMI uses for its in-cluster Redis and NATS connections (PR 6, threats T356/T388).
Trust is pinned to one CA file (never the system pool), TLS 1.2 is the floor, and a client certificate is re-read from disk on every handshake so a cert-manager renewal (which rewrites the mounted Secret) takes effect on the next reconnect without a restart.
Index ¶
Constants ¶
const ( EnvNATSCAFile = "TMI_NATS_TLS_CA_FILE" EnvNATSCertFile = "TMI_NATS_TLS_CERT_FILE" EnvNATSKeyFile = "TMI_NATS_TLS_KEY_FILE" // EnvNATSServerName overrides the hostname verified against the server // certificate. Needed when TMI_NATS_URL carries an IP address (the // extractor dials the ClusterIP because its sandbox has no DNS). EnvNATSServerName = "TMI_NATS_TLS_SERVER_NAME" )
Environment variables for the NATS client TLS files. The endpoint itself is TMI_NATS_URL (see internal/worker). All are optional; TLS is off when EnvNATSCAFile is unset.
Variables ¶
This section is empty.
Functions ¶
func Load ¶
Load builds a client TLS config that trusts only caFile. When certFile and keyFile are both set the config presents that client certificate, re-reading the pair on every handshake. SEM@d2c63e2: build a CA-pinned client TLS config, re-reading the client cert per handshake
func NATSFromEnv ¶
NATSFromEnv returns the NATS client TLS config described by the environment variables above, or (nil, nil) when EnvNATSCAFile is unset (plaintext, the code default). Callers pass a non-nil result to nats.Secure. SEM@d2c63e2: build the NATS client TLS config from NATS TLS env vars; nil when unset (reads env)
Types ¶
This section is empty.
Source Files
Directories